CN100450012C - A mobile agent-based intrusion detection system and method - Google Patents

Abstract

The invention belongs to the technical field of network security, in particular to a mobile agent-based intrusion detection system and method. The detection system consists of monitors, executors, controllers, coordinators, voting agents, result agents and response agents, denoted as PIDS. When a host running the PIDS system in the network finds suspicious behavior, it initiates a voting process. Multiple peer hosts in the network vote together to decide whether the event is a malicious behavior. If it is determined to be a malicious behavior, it will notify all hosts in the network to take appropriate measures to avoid it loss or harm occurs. The characteristics of the present invention are: fast response, one host in the network will immediately notify other hosts if a virus is found, avoiding losses such as file damage or data theft; The load changes little with the increase of network scale, which is suitable for large-scale network.

Description

A mobile agent-based intrusion detection system and method

technical field

The invention belongs to the technical field of network security, and in particular relates to a peer-to-peer intrusion detection system and method with self-learning ability.

Background technique

At present, with the rapid expansion of network information with the development of the Internet, people are increasingly dependent on the network, but the network also creates convenient conditions for the spread of viruses. The speed of transmission and the degree of harm of the virus have greatly increased, and the detection of the virus has become more difficult. How to effectively protect important information resources from being stolen and destroyed has become a major problem. The ideal method is to prevent virus infection and hacker intrusion, and upgrade the system in time. Anti-virus software and firewall technology cannot solve this problem well. Anti-virus software can only detect whether files are infected and repair damaged files, while firewalls can only prevent port connections, and cannot distinguish between legitimate connections and illegal intrusions. The traditional intrusion detection system adopts C/S structure, the server load is heavy, and the server is easy to become the target of attack. Once the server is damaged, the whole system will be paralyzed. Our peer-to-peer intrusion detection system and method based on mobile agent technology can solve these problems well.

Contents of the invention

The purpose of the present invention is to propose a detection system and method that can actively discover virus infection and network intrusion, so as to notify other hosts in the network to take timely measures to prevent data from being destroyed or stolen.

The detection system that can actively discover viruses and network intrusion proposed by the present invention is composed of a monitor, an actuator, a controller, a coordinator, a voting agent, a result agent and a response agent, and it is a peer-to-peer system based on mobile agent technology. Intrusion Detection System, abbreviated as PIDS system. Monitors, executors, controllers, coordinators, voting agents, result agents and response agents are all program components based on mobile agent technology, where monitors, executors, controllers and coordinators are static, voting agents, Result Agents and Response Agents are dynamic and can migrate across the network. A mobile agent is a program that simulates human behavior and relationships, has certain intelligence, and can migrate autonomously between homogeneous or heterogeneous network hosts and provide corresponding services. Each part of the system is described as follows:

(1) Monitor, the basic unit of the system, is mainly responsible for detecting security events that occur on the machine. There are many kinds of monitors in the system, and each monitor is responsible for a security event, including monitoring system logs, file changes, port connections, system logins, virus signatures, etc., and collects the characteristics of the event immediately after the monitor finds that a security event occurs information and report to the controller.

(2) The executor is also the basic unit of the system, and is mainly responsible for executing tasks related to security events delegated by the controller. Likewise, each type of executor is responsible for a task, including cleaning viruses, repairing files, rejecting connections, disconnecting from the network, and so on. Similar to monitors, actuators can also be dynamically added and upgraded to adapt to the ever-changing needs of viruses and intrusions.

(3) The controller is the middle layer, between the monitor, the actuator and the coordinator. The controller is responsible for analyzing the security event information reported by the monitor, and analyzes the event according to the local security knowledge base. If the controller can identify the security event information reported by the monitor, it will directly send a command to the executor, and the executor will execute the processing program according to the command of the controller. Otherwise, the controller extracts the key information of the event from the security report and reports it to the coordinator, requesting to initiate a voting process, and the hosts in multiple networks jointly monitor such events to make judgments and take further actions.

(4) The coordinator is the coordinator of the system. After receiving the request from the controller, it is responsible for initiating the voting process, requesting other hosts in the network to vote together to determine whether the security event is a malicious act. If so, notify all hosts to take necessary measures to avoid virus infection or network intrusion.

(5) Voting proxy is a dynamic mobile proxy. The coordinator of the host that initiated the voting realizes the collaborative decision-making of multiple hosts by sending the voting proxy to other hosts in the network. The voting proxy carries relevant information such as the characteristics of security events, source addresses, and voting event restrictions. The situation of the security event is voted on, and the coordinator counts the voting results and makes a final decision.

(6) The result agent is a mobile agent used to carry the voting results of each host. After each host fills in the votes in the result proxy, it sends the result proxy to the coordinator of the host that initiated the vote. Due to security reasons, the voting results are encrypted.

(7) The response agent is a mobile agent that notifies all hosts in the network of the final voting result. The coordinator of the host that initiates the vote counts the voting results. If more than half of the valid votes are cast, it is considered a malicious act and notifies all hosts to prepare for it.

The mobile agent-based intrusion detection method proposed by the present invention first requires all hosts to join a multicast group, and all hosts in the group form a peer-to-peer network. The PIDS system is located in each host in the network, and the system identifies virus infection and network intrusion according to the knowledge base on the machine, and then clears the virus to resist the intrusion; if a host finds suspicious events (may be new viruses or new Intrusion method), the host initiates a voting process in the network, and multiple hosts jointly judge whether the event is a malicious act; the specific steps of the voting process are: the host that discovers the suspicious event first extracts the relevant information of the suspicious event, randomly Select a certain number of hosts in the group to formulate a migration roadmap, and then send mobile agents carrying suspicious event information. The mobile agent migrates to each selected host according to the roadmap, and each selected host closely monitors whether such events occur locally, and the frequency of occurrence, and makes a judgment within a certain period of time. The judgment steps are as follows: PIDS system Set a safety factor for each suspicious event. This factor changes dynamically according to the frequency of the event. If the safety factor exceeds the threshold, it is considered malicious behavior. PIDS votes according to the change of the safety factor of the event within a certain period of time. Each host chosen then sends a proxy carrying the vote result to the host that initiated the vote. The host that initiates the vote counts the voting results. If the number of votes exceeds half, it is considered a malicious behavior; if it is determined to be a malicious behavior, all hosts in the network will be notified to take appropriate security measures.

In the present invention, all hosts join a multicast group, and the newly joined host notifies other hosts through a multicast message, and the host receiving the message responds, thereby declaring its own existence and discovering all hosts in the group.

The characteristics of the present invention are: fast response, one host in the network will immediately notify other hosts if a virus is discovered, avoiding losses such as file damage or data theft; only when suspicious behavior is found, the voting process is initiated, so the network load is very small, At the same time, it can solve the problem of distributed intrusion; the delay and network load change relatively little with the increase of network scale, which is suitable for large-scale networks.

Description of drawings

Figure 1 is a schematic diagram of the working principle of PIDS.

Figure 2 is a flow chart of PIDS work.

Figure 3 shows the working principle of the local area network autonomous antivirus system.

Numbers in the figure: 1 is the monitor, 2 is the executor, 3 is the controller, 4 is the coordinator, 5 is the voting agent, 6 is the result agent, and 7 is the response agent.

Detailed ways

In the present invention, components such as monitor, executor, controller, coordinator, voting proxy, result proxy and response proxy are interrelated and interdependent to form a hierarchical and complete system. The monitor 1 and the executor 2 are the most basic units of the PIDS system. The monitor is used to monitor various activities on the node and capture abnormal events. The executor is a component that performs operations such as cleaning viruses, repairing files, and disconnecting network connections. Both the actuator and the actuator are the lowest-level units under the controller.

As shown in Figure 1, if the controller 3 in the A host reports suspicious events to the coordinator 4, the coordinator 4 randomly selects a certain number of hosts (such as B and C) in the network to formulate a roadmap, and then sends the network Send a voting agent 5 carrying the suspicious event information, the voting agent 5 migrates in the network according to the roadmap, and notifies other hosts (B, C) to monitor the activities of such events on the machine, and dynamically according to the activity frequency of the event Update the safety factor of the event, and when the safety factor exceeds the threshold, the event is determined to be malicious. The safety factor does not change proportionally with the frequency of events, but increases faster and faster as the frequency of events increases, so that the system responds more promptly and quickly. For example, the safety factor of an event dynamically changes to {1/10, 1/8, 1/6, 1/4, 1/2, 1}, and when such an event occurs for the first time within a certain period of time, the safety factor is 1 /10, it becomes 1/8 for the second time, 1/6 for the third time, 1/4 for the fourth time, 1/2 for the fifth time, 1 for the sixth time to exceed the safety system threshold, Confirmation of Malicious Behavior. Of course, the frequency of incidents gradually decreases, and the safety factor decreases accordingly, and the initial decrease is faster, and then the decreasing range becomes smaller and smaller. Within a certain time range (the time range is determined by the requirements of the voting agent), other hosts (B, C) send the result agent 6 carrying voting information to host A, and the host A that initiates the vote counts the voting results. Half of them are identified as malicious behavior, and a response agent 7 is sent to the network to notify all hosts to take appropriate action.

Based on the mobile agent intrusion detection method, we design a "LAN autonomous antivirus system". In this case (as shown in Figure 3), multiple hosts (S, A, B, C, D) form a simple local area network, and each host is equipped with a set of "autonomous antivirus system for local area network" software. The basic structure shown in Figure 1 is adopted. The following uses the system's autonomous detection process for the variant code red virus to introduce its working mechanism:

(1) The system "Code Red Virus Monitor" on the host S detects suspicious events with characteristic code information similar to the Code Red virus, and the monitor collects the characteristic information of the suspicious virus and forwards it to the upper-layer controller of the system for control The server cannot confirm it according to the knowledge base on the machine, so it simply extracts and processes the collected information and then forwards it to the coordinator, and the coordinator immediately sends a "voting agent" request for assistance to hosts A, B, C, and D in the network. This initiates the voting process.

(2) The systems A, B, C, and D that received the "voting proxy" monitor the activities of such events on the machine, within a certain period of time (the voting time is set in the voting proxy by the system that initiates the voting process) Vote on the safety of the event. The initial safety factor set by the system for this suspicious event is {1/10/1, 1/8/2, 1/6/3, 1/4/4, 1/2/5, 1/1/6}, That is, within a certain period of time (here, one minute), the suspicious event occurs once, and the safety factor is 1/10, and twice is 1/8. When it occurs six times, the safety factor becomes 1, which is the threshold value. The system votes for confirmation. Voting information is included in the result agent, which is passed to the suspicious event source host.

(3) The source host system counts the voting results. If it exceeds half of the valid votes, it will be deemed as a malicious behavior, and the response agent will be sent to notify each host in the network to take corresponding security measures. In addition, each host can notify and send system upgrade patches to other hosts to complete the system upgrade at the fastest speed and prevent viruses from infecting the entire network. (4) The test shows that the virus detection rate of the system is above 98%. Compared with the traditional system, it has the advantages of intelligence, fast response, small network load and suitable for large-scale networks.

Claims (2)

1, a kind of intrusion detection system based on mobile agent, be recorded as PIDS system, this system is located in each host computer in the network, it is characterized in that by program component monitor, executor, controller, coordinator, voting agent, result Composed of agents and response agents, the monitor, executor, controller and coordinator are static, while the voting agent, result agent and response agent are dynamic and can be migrated in the network. The details are as follows: (1) Monitor, the basic unit of the system, is mainly responsible for detecting security events that occur on the machine. There are multiple monitors in the system, and each monitor is responsible for a security event, including monitoring system logs, file changes, ports Connection, system login, search for virus signatures, monitor collects event signature information immediately after a security event occurs and reports to the controller; (2) The executor, which is also the basic unit of the system, is mainly responsible for performing tasks related to security events delegated by the controller; each executor is responsible for a task, including virus removal, file repair, connection rejection, and network disconnection; execution Servers can also be dynamically added and upgraded to adapt to the ever-changing needs of viruses and intrusions; (3) The controller is the middle layer, between the monitor, the executor and the coordinator; the controller is responsible for analyzing the security event information reported by the monitor, and analyzing the event according to the local security knowledge base; if the controller If the security event information reported by the monitor can be identified, the command is sent directly to the executor, and the executor executes the processing program according to the command of the controller; otherwise, the controller extracts the key information of the event from the security event information report to the coordinator Report, request to initiate a voting process, and hosts in multiple networks jointly monitor such events to make judgments and take further actions; (4) The coordinator is the coordinator of the system. After receiving the request from the controller, it is responsible for initiating the voting process, requesting other hosts in the network to vote together to determine whether the security event is a malicious act; if so, notify all hosts to take necessary measures to avoid virus infection or network intrusion; (5) Voting agent is a dynamic mobile agent. The coordinator of the host that initiates the voting realizes the collaborative decision-making of multiple hosts by sending the voting agent to other hosts in the network. The voting agent carries the characteristics, source address and voting event of the security event To restrict information, the hosts in the network vote on the security event according to the situation of the host, and the coordinator of the host that initiates the vote counts the voting results and makes a final decision; (6) The result agent is a mobile agent used to carry the voting results of each host. After each host fills in the vote in the result agent, it sends the result agent to the coordinator of the host that initiated the vote; (7) The response agent is a mobile agent that notifies all hosts in the network of the final voting results. The coordinator of the host that initiates the vote counts the voting results. If more than half of the valid votes are cast, it is considered a malicious act and notifies all hosts to prepare for it. . 2. A mobile agent-based intrusion detection method is characterized in that at first all hosts are required to join a multicast group, and all hosts in the group form a peer-to-peer network; the mobile agent-based intrusion detection system is located in each host in the network In , the detection system identifies virus infection and network intrusion according to the knowledge base on the local machine, and then removes the virus to resist the intrusion; if a host finds a suspicious event and cannot confirm the suspicious event according to the knowledge base on the local machine, then The host that discovers the suspicious event initiates a voting process in the network, and multiple hosts jointly judge whether the event is a malicious act; the specific steps of the voting process are: the host that discovers the suspicious event first extracts the relevant information of the suspicious event, and randomly Select a certain number of hosts in the group to formulate a migration roadmap, and then send the mobile agent carrying suspicious event information; the mobile agent migrates to each selected host according to the roadmap, and each selected host closely monitors whether such events occur on this machine , and the frequency of occurrence, and make a judgment within a certain period of time. The judgment steps are as follows: the mobile agent-based intrusion detection system sets a safety factor for each suspicious event, and this coefficient changes dynamically according to the frequency of the event. If If the safety factor exceeds the threshold, it is considered malicious behavior. The mobile agent-based intrusion detection system votes according to the change of the safety factor of the event within a certain period of time, and then each selected host sends an agent carrying the voting result to the initiating The host that votes; the host that initiates the vote counts the voting results. If the number of votes exceeds half, it is considered a malicious behavior; if it is determined to be a malicious behavior, all hosts in the network will be notified to take appropriate security measures.

Images